OSDN Git Service

enhaned request parameter check.
[quickedit/quick_edit.git] / app / controllers / quick_edit_issues_controller.rb
1 class QuickEditIssuesController < ApplicationController
2   include ApplicationHelper
3   before_filter :find_issues
4   before_filter :check_first_issue
5   before_filter :check_target_specifier
6
7   def edit
8     @dialog_params = nil
9     @issue.available_custom_fields.each do |f|
10       custom_field_name = 'issue[custom_field_values][%d]' % f.id
11       if custom_field_name == @target_specifier
12         @dialog_params = get_input_dialog_params_for_custom_fields(@issue, @target_specifier, f)
13         @dialog_params[:description] = f.description.presence if f.attributes().has_key?('description')
14       end
15     end
16     if @dialog_params.nil?
17       @dialog_params = get_input_dialog_params_for_core_fields(@issue, @target_specifier)
18       @dialog_params[:description] = nil
19     end
20     @dialog_params[:description] = nil if (@dialog_params[:description] == "")
21     @dialog_params[:issue_ids] = params[:ids]
22     @dialog_params[:back_url] = params[:back_url]
23     @dialog_params[:default_value] = params[:default_value] unless (params[:default_value].nil?)
24   end
25
26 private
27   # rails filter
28   def check_first_issue
29     if @issues.empty?
30       logger.warn "### quick edit ### issues not found."
31       render_404
32     end
33
34     @issue = @issues[0]
35   end
36
37   # rails filter
38   def check_target_specifier
39     @target_specifier = params[:target_specifier]
40     if @target_specifier.nil?
41       logger.warn "### quick edit ### missing target specifier."
42       render_404
43       return
44     end
45
46     parsed = parse_target_specifier(@target_specifier)
47     if parsed.nil? || parsed.empty?
48       logger.warn "### quick edit ### invalid target specifier. target_specifier=" + @target_specifier
49       render_404
50     end
51
52     attribute_name = parsed[0]
53     unless @issue.safe_attribute_names.include?(attribute_name)
54       logger.warn "### quick edit ### no safe attribute. target_specifier=" + @target_specifier
55       render_404
56     end
57   end
58
59   def get_input_dialog_params_for_core_fields(issue, target_specifier)
60     attribute_name = parse_target_specifier(target_specifier)[0]
61
62     caption = get_attribute_caption(attribute_name)
63     field_type = get_attribute_type(attribute_name)
64     default_value = issue[attribute_name]
65     default_value = "" if default_value.nil?
66     validation_pattern = get_field_validation_pattern(field_type)
67     help_message = get_field_help_message(field_type)
68     clear_pseudo_value = nil
69     clear_pseudo_value = 'none' if %w(parent_issue_id start_date due_date estimated_hours).include?(attribute_name)
70
71     ret =
72       { :attribute_name => attribute_name.to_sym,
73         :caption => caption,
74         :target_specifier => target_specifier,
75         :field_type => field_type,
76         :default_value => default_value,
77         :validation_pattern => validation_pattern,
78         :help_message => help_message,
79         :clear_pseudo_value => clear_pseudo_value
80       }
81   end
82
83   def get_input_dialog_params_for_custom_fields(issue, target_specifier, custom_field)
84     attribute_name = parse_target_specifier(target_specifier)[0]
85
86     caption = custom_field.name
87     field_type = custom_field.field_format.to_sym
88     default_value = issue.editable_custom_field_values.detect {|v| v.custom_field_id == custom_field.id}
89     default_value = "" if default_value.nil?
90     validation_pattern = get_field_validation_pattern(field_type)
91     help_message = get_field_help_message(field_type)
92
93     ret =
94       { :attribute_name => attribute_name.to_sym,
95         :caption => caption,
96         :target_specifier => target_specifier,
97         :field_type => field_type,
98         :default_value => default_value,
99         :validation_pattern => validation_pattern,
100         :help_message => help_message,
101         :clear_pseudo_value => '__none__'
102       }
103   end
104
105   def get_field_validation_pattern(field_type)
106      case field_type.to_sym
107      when :string
108         pattern = ''
109      when :text
110         pattern = ''
111      when :int
112         pattern = '\d+'
113      when :float
114         pattern = '^[+-]?(\d+|\d*\.\d+|\d+\.\d+)($|[eE][+-]?\d+$)'
115      when :date
116         pattern = '\d{4}-\d{2}-\d{2}'
117      end
118   end
119
120   def get_field_help_message(field_type)
121     help_message= l(:text_edit_confirm)
122     help_message += " (yyyy-mm-dd)" if field_type == :date
123     help_message
124   end
125
126 end